From d4b7e29348bb4b7bc784d17ab48b73f53c44e12a Mon Sep 17 00:00:00 2001
From: dlawler489 <104159223@student.swin.edu.au>
Date: Tue, 15 Sep 2026 07:36:47 +1000
Subject: [PATCH] Browse archives, preview companion files, and view
 FBX/STEP/3DM/OBJ+MTL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Archives
- ZIP, 7Z, RAR and TAR/.tar.gz uploads are indexed in the background into
  archive_entries (7-Zip compiled to WASM in a worker thread; node-tar for
  tar). macOS/Windows clutter and paths that could escape the extraction
  folder are skipped.
- Models inside archives are extracted once per archive to hash and
  geometry-fingerprint them, so duplicates are found inside packs too.
  Pictures, PDFs and readmes are listed but never matched.
- New routes list an archive's entries and serve/convert a single entry,
  extracted on first use and cached under extracted/.

Viewer
- Model detail lists what's inside each archive with view/download links;
  opening an entry adds a viewer tab.
- New 3D formats: FBX (with sibling textures), OBJ with its MTL and
  textures, STEP/STP via occt-import-js, and Rhino 3DM via rhino3dm — the
  WASM readers are served from node_modules, loaded on first use.
- Pictures, PDFs and text files (jpg/png/gif/webp/bmp/svg, pdf, txt/md)
  can be uploaded and preview in the viewer; a model without an embedded
  3MF preview uses its first picture as the card thumbnail.
- Inline file responses send nosniff, and SVGs are sandboxed.
- GLB conversions write to a temp file and rename, so a half-written
  preview is never served; a later tab can't be overdrawn by a slow load.
- Better 3MF card image: the project thumbnail or plate 1 render, not a
  slicer pick map.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .dockerignore             |   1 +
 .gitignore                |   1 +
 db/schema.sql             |  21 ++++
 lib/archiveWorker.js      |  82 +++++++++++++++
 lib/archives.js           | 133 ++++++++++++++++++++++++
 lib/fileProcessor.js      |  52 ++++++++--
 lib/fingerprint.js        | 177 ++++++++++++++++++++++++-------
 lib/store.js              |  81 +++++++++++++--
 package-lock.json         | 109 ++++++++++++++++++-
 package.json              |   6 +-
 public/app.js             | 145 ++++++++++++++++++++------
 public/index.html         |   6 +-
 public/styles.css         |  14 +++
 public/viewer.js          | 213 +++++++++++++++++++++++++++++++-------
 server.js                 | 114 +++++++++++++++-----
 test/archives.test.js     |  47 +++++++++
 test/fixtures/pack.7z     | Bin 0 -> 1608 bytes
 test/fixtures/pack.tar.gz | Bin 0 -> 1779 bytes
 test/fixtures/pack.zip    | Bin 0 -> 2211 bytes
 19 files changed, 1045 insertions(+), 157 deletions(-)
 create mode 100644 lib/archiveWorker.js
 create mode 100644 lib/archives.js
 create mode 100644 test/archives.test.js
 create mode 100644 test/fixtures/pack.7z
 create mode 100644 test/fixtures/pack.tar.gz
 create mode 100644 test/fixtures/pack.zip

diff --git a/.dockerignore b/.dockerignore
index ee63c18..51ef26e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -14,3 +14,4 @@ npm-debug.log*
 Dockerfile
 .dockerignore
 docker-compose.yml
+extracted
diff --git a/.gitignore b/.gitignore
index 3deaf18..fa332d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ thumbnails/
 glb/
 tools/venv/
 __pycache__/
+extracted/
diff --git a/db/schema.sql b/db/schema.sql
index c14c9d8..db464c4 100644
--- a/db/schema.sql
+++ b/db/schema.sql
@@ -124,6 +124,27 @@ ALTER TABLE models ADD COLUMN IF NOT EXISTS notes TEXT NOT NULL DEFAULT '';
 ALTER TABLE models ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMPTZ;
 CREATE INDEX IF NOT EXISTS idx_models_deleted ON models(deleted_at);
 
+-- Archive files (zip/7z/rar/tar) are indexed in the background:
+-- null = not yet, ok | error (with archive_error).
+ALTER TABLE files ADD COLUMN IF NOT EXISTS archive_status TEXT;
+ALTER TABLE files ADD COLUMN IF NOT EXISTS archive_error TEXT;
+
+-- Files inside archives, so they can be browsed, previewed and matched as duplicates.
+CREATE TABLE IF NOT EXISTS archive_entries (
+  id               SERIAL PRIMARY KEY,
+  file_id          INTEGER NOT NULL REFERENCES files(id) ON DELETE CASCADE,
+  path             TEXT NOT NULL,     -- path inside the archive, as the archive stores it
+  format           TEXT NOT NULL,
+  size             BIGINT NOT NULL DEFAULT 0,
+  sha256           TEXT,
+  geometry_hash    TEXT,
+  geometry_status  TEXT,              -- same states as files.geometry_status
+  fingerprinted_at TIMESTAMPTZ,
+  UNIQUE (file_id, path)
+);
+CREATE INDEX IF NOT EXISTS idx_entries_sha256   ON archive_entries(sha256);
+CREATE INDEX IF NOT EXISTS idx_entries_geometry ON archive_entries(geometry_hash);
+
 -- Duplicate groups marked "not duplicates" (signature = sorted model ids).
 CREATE TABLE IF NOT EXISTS duplicate_dismissals (
   signature  TEXT PRIMARY KEY,
diff --git a/lib/archiveWorker.js b/lib/archiveWorker.js
new file mode 100644
index 0000000..a8da4e5
--- /dev/null
+++ b/lib/archiveWorker.js
@@ -0,0 +1,82 @@
+// Worker thread running 7-Zip (compiled to WASM) for ZIP/7Z/RAR archives.
+// 7-Zip calls are synchronous, so they run here to keep the server responsive.
+
+const { parentPort } = require('worker_threads');
+const SevenZip = require('7z-wasm');
+
+let sevenZip = null;
+const output = [];
+
+// The host filesystem is mounted at /host inside the WASM filesystem.
+const host = (p) => `/host${p}`;
+
+async function instance() {
+  if (!sevenZip) {
+    sevenZip = await SevenZip({ print: (l) => output.push(l), printErr: (l) => output.push(l) });
+    sevenZip.FS.mkdir('/host');
+    sevenZip.FS.mount(sevenZip.NODEFS, { root: '/' }, '/host');
+  }
+  return sevenZip;
+}
+
+async function run(args) {
+  const sz = await instance();
+  output.length = 0;
+  let code;
+  try {
+    code = sz.callMain(args);
+  } catch (err) {
+    code = err && typeof err.status === 'number' ? err.status : 2;
+  }
+  return { code, lines: output.slice() };
+}
+
+function errorText(lines) {
+  const line = lines.find((l) => /error|wrong password|can ?not open|unsupported|headers/i.test(l));
+  return line ? line.trim() : null;
+}
+
+// Parses `7zz l -slt` into [{ path, size }] for files (folders are dropped).
+function parseListing(lines) {
+  const start = lines.findIndex((l) => l.startsWith('----------'));
+  if (start === -1) return null;
+  const entries = [];
+  let cur = {};
+  const flush = () => {
+    const isFolder = cur.Folder === '+' || (cur.Attributes || '').startsWith('D');
+    if (cur.Path !== undefined && !isFolder) entries.push({ path: cur.Path, size: Number(cur.Size) || 0 });
+    cur = {};
+  };
+  for (const line of lines.slice(start + 1)) {
+    if (!line.trim()) { flush(); continue; }
+    const i = line.indexOf(' = ');
+    if (i > 0) cur[line.slice(0, i)] = line.slice(i + 3);
+  }
+  flush();
+  return entries;
+}
+
+async function list(archive) {
+  // A dummy password makes encrypted archives fail fast instead of prompting.
+  const { code, lines } = await run(['l', '-slt', '-pprinthive', host(archive)]);
+  const entries = parseListing(lines);
+  if (code !== 0 || !entries) throw new Error(errorText(lines) || `7-Zip could not read the archive (exit ${code})`);
+  return entries;
+}
+
+// Extracts the named entries (keeping their folders) under destDir. Callers
+// check which files actually arrived.
+async function extract(archive, entries, destDir) {
+  const { code, lines } = await run(
+    ['x', host(archive), `-o${host(destDir)}`, '-y', '-spd', '-bsp0', '-pprinthive', '--', ...entries]);
+  return { code, error: code === 0 ? null : errorText(lines) };
+}
+
+parentPort.on('message', async ({ id, op, archive, entries, destDir }) => {
+  try {
+    const result = op === 'list' ? await list(archive) : await extract(archive, entries, destDir);
+    parentPort.postMessage({ id, result });
+  } catch (err) {
+    parentPort.postMessage({ id, error: err.message });
+  }
+});
diff --git a/lib/archives.js b/lib/archives.js
new file mode 100644
index 0000000..0ec1fc4
--- /dev/null
+++ b/lib/archives.js
@@ -0,0 +1,133 @@
+// Lists and extracts files inside archives. ZIP/7Z/RAR go through 7-Zip (WASM,
+// in a worker thread); TAR and .tar.gz go through node-tar. Extracted entries
+// are cached under EXTRACT_DIR/<file id>/ and can always be re-extracted.
+
+const fs = require('fs');
+const path = require('path');
+const { Worker } = require('worker_threads');
+const tar = require('tar');
+
+const EXTRACT_DIR = path.resolve(process.env.EXTRACT_DIR || './extracted');
+const TAR_FILE_TYPES = ['File', 'OldFile', 'ContiguousFile'];
+
+let worker = null;
+let nextId = 1;
+const pending = new Map();
+
+function failPending(err) {
+  for (const p of pending.values()) p.reject(err);
+  pending.clear();
+  worker = null;
+}
+
+// The worker keeps the process alive only while a request is outstanding, so
+// an idle worker never stops Node from exiting.
+function sevenZip(message) {
+  if (!worker) {
+    worker = new Worker(path.join(__dirname, 'archiveWorker.js'));
+    worker.on('message', ({ id, result, error }) => {
+      const p = pending.get(id);
+      pending.delete(id);
+      if (pending.size === 0 && worker) worker.unref();
+      if (p) error ? p.reject(new Error(error)) : p.resolve(result);
+    });
+    worker.on('error', failPending);
+    worker.on('exit', () => failPending(new Error('Archive worker stopped')));
+  }
+  return new Promise((resolve, reject) => {
+    const id = nextId++;
+    pending.set(id, { resolve, reject });
+    worker.ref();
+    worker.postMessage({ id, ...message });
+  });
+}
+
+const isTar = (format) => format === 'tar' || format === 'tgz';
+const clean = (p) => p.replace(/^\.\//, '');
+
+// Clutter archivers add (macOS resource forks, Finder/Explorer files).
+function isJunk(entryPath) {
+  const parts = clean(entryPath).split('/');
+  const name = parts[parts.length - 1];
+  return parts.includes('__MACOSX') || name.startsWith('._') || name === '.DS_Store' || name === 'Thumbs.db';
+}
+
+// Paths that could land outside the extraction folder are never used.
+function isSafe(entryPath) {
+  return Boolean(entryPath) && !path.isAbsolute(entryPath) && !entryPath.split(/[\\/]/).includes('..');
+}
+
+// file: { file_path, format }. Returns [{ path, size }] of real files.
+async function listEntries(file) {
+  const abs = path.resolve(file.file_path);
+  let raw;
+  if (isTar(file.format)) {
+    raw = [];
+    await tar.t({
+      file: abs,
+      onReadEntry: (e) => { if (TAR_FILE_TYPES.includes(e.type)) raw.push({ path: e.path, size: e.size }); },
+    });
+  } else {
+    raw = await sevenZip({ op: 'list', archive: abs });
+  }
+  return raw.filter((e) => isSafe(e.path) && !isJunk(e.path));
+}
+
+function tempDir() {
+  fs.mkdirSync(EXTRACT_DIR, { recursive: true });
+  return fs.mkdtempSync(path.join(EXTRACT_DIR, '.tmp-'));
+}
+
+// Extracts entries into destDir. Returns Map(entry path -> absolute path) for
+// the ones that came out; archive-level failures throw.
+async function extractMany(file, entryPaths, destDir) {
+  const abs = path.resolve(file.file_path);
+  const wanted = new Set(entryPaths.filter(isSafe));
+  if (isTar(file.format)) {
+    await tar.x({ file: abs, cwd: destDir, filter: (p) => wanted.has(p) });
+  } else {
+    const { code, error } = await sevenZip({ op: 'extract', archive: abs, entries: [...wanted], destDir });
+    if (code !== 0 && error) console.warn(`7-Zip reported a problem extracting from ${abs}: ${error}`);
+  }
+  const out = new Map();
+  for (const p of wanted) {
+    const target = path.resolve(destDir, p);
+    if (target.startsWith(destDir + path.sep) && fs.existsSync(target)) out.set(p, target);
+  }
+  return out;
+}
+
+function entryCachePath(fileId, entry) {
+  return path.join(EXTRACT_DIR, String(fileId), `${entry.id}${path.extname(entry.path).toLowerCase()}`);
+}
+
+const inflight = new Map();
+
+// file: { id, file_path, format }; entry: { id, path }. Returns the absolute
+// path of a cached copy, extracting it on first use.
+async function extractEntry(file, entry) {
+  const dest = entryCachePath(file.id, entry);
+  if (fs.existsSync(dest)) return dest;
+  if (!inflight.has(dest)) {
+    const job = (async () => {
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      const tmp = tempDir();
+      try {
+        const got = (await extractMany(file, [entry.path], tmp)).get(entry.path);
+        if (!got) throw new Error(`Could not extract ${clean(entry.path)} from the archive`);
+        fs.renameSync(got, dest);
+      } finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+      }
+    })().finally(() => inflight.delete(dest));
+    inflight.set(dest, job);
+  }
+  await inflight.get(dest);
+  return dest;
+}
+
+function removeExtracted(fileId) {
+  fs.rmSync(path.join(EXTRACT_DIR, String(fileId)), { recursive: true, force: true });
+}
+
+module.exports = { listEntries, extractMany, extractEntry, removeExtracted, tempDir, isJunk };
diff --git a/lib/fileProcessor.js b/lib/fileProcessor.js
index 2e97843..2da16f9 100644
--- a/lib/fileProcessor.js
+++ b/lib/fileProcessor.js
@@ -5,18 +5,25 @@ const AdmZip = require('adm-zip');
 
 const THUMBNAIL_DIR = './thumbnails';
 
-const MODEL_FORMATS = ['stl', '3mf', 'obj', 'step', 'stp', 'gcode', 'gco', 'zip'];
+const MODEL_FORMATS = ['stl', '3mf', 'obj', 'fbx', 'step', 'stp', '3dm', 'gcode', 'gco'];
+const ARCHIVE_FORMATS = ['zip', '7z', 'rar', 'tar', 'tgz'];
+const IMAGE_FORMATS = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp', 'svg'];
+// Kept with a model and viewable, but never matched as duplicates.
+const COMPANION_FORMATS = [...IMAGE_FORMATS, 'pdf', 'txt', 'md', 'mtl'];
+const ALLOWED_FORMATS = [...MODEL_FORMATS, ...ARCHIVE_FORMATS, ...COMPANION_FORMATS];
 
 function ensureThumbnailDir() {
   if (!fs.existsSync(THUMBNAIL_DIR)) fs.mkdirSync(THUMBNAIL_DIR, { recursive: true });
 }
 
 function formatOf(filename) {
-  return path.extname(filename).slice(1).toLowerCase();
+  const lower = filename.toLowerCase();
+  if (lower.endsWith('.tar.gz')) return 'tgz';
+  return path.extname(lower).slice(1);
 }
 
 function isAllowed(filename) {
-  return MODEL_FORMATS.includes(formatOf(filename));
+  return ALLOWED_FORMATS.includes(formatOf(filename));
 }
 
 // Geometry metadata. Only STL is computed natively today; others return nulls
@@ -37,16 +44,28 @@ function extractMetadata(filePath, format) {
   }
 }
 
+// Which embedded PNG makes the best card image: the project thumbnail, then the
+// first plate render. Slicer pick maps, top views and small/unlit variants last.
+function thumbnailRank(name) {
+  if (name === 'metadata/thumbnail.png') return 0;
+  if (/metadata\/plate_1\.png$/.test(name)) return 1;
+  if (/metadata\/plate_\d+\.png$/.test(name)) return 2;
+  if (/(pick_|top_|no_light|_small)/.test(name)) return 9;
+  return 5;
+}
+
 // A .3mf is a zip; slicers embed a PNG preview under /Metadata/. If present,
 // pull it out as the model thumbnail. Returns a path under thumbnails/ or null.
 function extract3mfThumbnail(filePath, baseName) {
   try {
     ensureThumbnailDir();
     const zip = new AdmZip(filePath);
-    const entry = zip.getEntries().find((e) => {
-      const n = e.entryName.toLowerCase();
-      return n.endsWith('.png') && (n.includes('thumbnail') || n.includes('/metadata/'));
-    });
+    const entry = zip.getEntries()
+      .filter((e) => {
+        const n = e.entryName.toLowerCase();
+        return n.endsWith('.png') && (n.includes('thumbnail') || n.includes('metadata/'));
+      })
+      .sort((a, b) => thumbnailRank(a.entryName.toLowerCase()) - thumbnailRank(b.entryName.toLowerCase()))[0];
     if (!entry) return null;
     const out = path.join(THUMBNAIL_DIR, `${baseName}.png`);
     fs.writeFileSync(out, entry.getData());
@@ -57,4 +76,21 @@ function extract3mfThumbnail(filePath, baseName) {
   }
 }
 
-module.exports = { MODEL_FORMATS, formatOf, isAllowed, extractMetadata, extract3mfThumbnail };
+// Copy a picture that came with a model into thumbnails/ (a copy, so replacing
+// the thumbnail later never deletes the model's own file).
+function copyAsThumbnail(filePath, baseName) {
+  try {
+    ensureThumbnailDir();
+    const out = path.join(THUMBNAIL_DIR, `${baseName}-image${path.extname(filePath).toLowerCase()}`);
+    fs.copyFileSync(filePath, out);
+    return out;
+  } catch (err) {
+    console.error('Image thumbnail copy failed:', err.message);
+    return null;
+  }
+}
+
+module.exports = {
+  MODEL_FORMATS, ARCHIVE_FORMATS, IMAGE_FORMATS, COMPANION_FORMATS, ALLOWED_FORMATS,
+  formatOf, isAllowed, extractMetadata, extract3mfThumbnail, copyAsThumbnail,
+};
diff --git a/lib/fingerprint.js b/lib/fingerprint.js
index d4031e4..3f936db 100644
--- a/lib/fingerprint.js
+++ b/lib/fingerprint.js
@@ -1,16 +1,21 @@
-// Background worker that fingerprints stored files for the duplicate finder: a
-// SHA-256 of the bytes for every file, plus a geometry fingerprint for mesh
+// Background worker that indexes and fingerprints stored files for the
+// duplicate finder: a SHA-256 of the bytes, plus a geometry fingerprint for mesh
 // formats so the same model still matches after being renamed, re-exported
-// (ASCII/binary STL) or converted (STL -> 3MF).
+// (ASCII/binary STL) or converted (STL -> 3MF). Archives are listed, and the
+// models inside them are fingerprinted too.
 
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const db = require('./db');
+const store = require('./store');
+const archives = require('./archives');
+const { MODEL_FORMATS, ARCHIVE_FORMATS, formatOf } = require('./fileProcessor');
 const { PYTHON, runScript } = require('./python');
 
 const GEOMETRY_FORMATS = ['stl', 'obj', '3mf'];
 const BATCH = 10;
+const TABLES = ['files', 'archive_entries'];
 
 let pythonAvailable = true;
 let running = false;
@@ -58,64 +63,153 @@ async function measure(paths) {
   return results;
 }
 
-async function fingerprintGeometry(rows) {
-  const abs = (row) => path.resolve(row.file_path);
+// rows: [{ id, format, abs }] from `table` ('files' or 'archive_entries').
+async function fingerprintGeometry(rows, table) {
+  if (!TABLES.includes(table)) throw new Error(`Unknown table ${table}`);
   // 3MF projects can be big, so each gets its own run; that keeps a queued
   // preview from waiting behind a whole batch of them.
   const chunks = [rows.filter((r) => r.format !== '3mf'), ...rows.filter((r) => r.format === '3mf').map((r) => [r])];
   for (const chunk of chunks.filter((c) => c.length)) {
-    const results = await measure(chunk.map(abs));
+    const results = await measure(chunk.map((r) => r.abs));
     for (const row of chunk) {
-      let r = results.get(abs(row));
+      let r = results.get(row.abs);
       // A batch that died part-way: retry the missing file on its own.
-      if (!r && chunk.length > 1) r = (await measure([abs(row)])).get(abs(row));
+      if (!r && chunk.length > 1) r = (await measure([row.abs])).get(row.abs);
       const key = r && r.fp ? geometryKey(r.fp) : null;
-      await db.query('UPDATE files SET geometry_hash = $2, geometry_status = $3 WHERE id = $1',
+      await db.query(`UPDATE ${table} SET geometry_hash = $2, geometry_status = $3 WHERE id = $1`,
         [row.id, key, key ? 'ok' : 'error']);
     }
   }
 }
 
-async function run() {
-  for (;;) {
-    const { rows } = await db.query(
-      `SELECT id, file_path, format, fingerprinted_at FROM files
-       WHERE fingerprinted_at IS NULL OR (geometry_status IS NULL AND $1::boolean)
-       ORDER BY id LIMIT $2`, [pythonAvailable, BATCH]);
-    if (rows.length === 0) return;
+// Runs fn; if Python turns out to be missing, geometry fingerprints are switched
+// off for this process (content hashes still run).
+async function withPython(fn) {
+  try {
+    await fn();
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+    pythonAvailable = false;
+    console.warn(`Geometry fingerprints disabled: no Python at ${PYTHON} (content hashes still run).`);
+  }
+}
 
+async function fingerprintFiles() {
+  const { rows } = await db.query(
+    `SELECT id, file_path, format, fingerprinted_at FROM files
+     WHERE fingerprinted_at IS NULL OR (geometry_status IS NULL AND $1::boolean)
+     ORDER BY id LIMIT $2`, [pythonAvailable, BATCH]);
+  if (rows.length === 0) return false;
+
+  const geometry = [];
+  for (const row of rows) {
+    const abs = path.resolve(row.file_path);
+    try {
+      if (!fs.existsSync(abs)) {
+        await db.query(`UPDATE files SET fingerprinted_at = now(), geometry_status = 'missing' WHERE id = $1`, [row.id]);
+        continue;
+      }
+      if (!row.fingerprinted_at) {
+        await db.query('UPDATE files SET sha256 = $2, fingerprinted_at = now() WHERE id = $1',
+          [row.id, await sha256File(abs)]);
+      }
+      if (!GEOMETRY_FORMATS.includes(row.format)) {
+        await db.query(`UPDATE files SET geometry_status = 'na' WHERE id = $1`, [row.id]);
+      } else if (pythonAvailable) {
+        geometry.push({ id: row.id, format: row.format, abs });
+      }
+    } catch (err) {
+      console.warn(`Fingerprint failed for file ${row.id}:`, err.message);
+      await db.query(`UPDATE files SET fingerprinted_at = now(), geometry_status = 'error' WHERE id = $1`, [row.id]);
+    }
+  }
+  if (geometry.length) await withPython(() => fingerprintGeometry(geometry, 'files'));
+  return true;
+}
+
+async function indexArchives() {
+  const { rows } = await db.query(
+    `SELECT id, file_path, format FROM files
+     WHERE format = ANY($1) AND archive_status IS NULL ORDER BY id LIMIT 5`, [ARCHIVE_FORMATS]);
+  for (const file of rows) {
+    try {
+      const entries = await archives.listEntries(file);
+      await store.replaceArchiveEntries(file.id,
+        entries.map((e) => ({ path: e.path, size: e.size, format: formatOf(e.path) })));
+      await db.query(`UPDATE files SET archive_status = 'ok', archive_error = NULL WHERE id = $1`, [file.id]);
+    } catch (err) {
+      console.warn(`Could not read archive (file ${file.id}):`, err.message);
+      await db.query(`UPDATE files SET archive_status = 'error', archive_error = $2 WHERE id = $1`,
+        [file.id, err.message.slice(0, 300)]);
+    }
+  }
+  return rows.length > 0;
+}
+
+const ENTRY_PENDING = 'e.fingerprinted_at IS NULL OR (e.geometry_status IS NULL AND $1::boolean)';
+
+// Fingerprints the pending entries of one archive, extracting its models in a
+// single pass (cheaper than one extraction per entry, especially for solid 7z).
+async function fingerprintEntries() {
+  const { rows: [file] } = await db.query(
+    `SELECT f.id, f.file_path, f.format FROM files f
+     WHERE EXISTS (SELECT 1 FROM archive_entries e WHERE e.file_id = f.id AND (${ENTRY_PENDING}))
+     ORDER BY f.id LIMIT 1`, [pythonAvailable]);
+  if (!file) return false;
+  const { rows: entries } = await db.query(
+    `SELECT e.id, e.path, e.format, e.fingerprinted_at FROM archive_entries e
+     WHERE e.file_id = $2 AND (${ENTRY_PENDING}) ORDER BY e.id LIMIT 500`, [pythonAvailable, file.id]);
+
+  // Pictures, documents and nested archives are listed but not matched as duplicates.
+  const others = entries.filter((e) => !MODEL_FORMATS.includes(e.format));
+  if (others.length) {
+    await db.query(`UPDATE archive_entries SET fingerprinted_at = now(), geometry_status = 'na' WHERE id = ANY($1::int[])`,
+      [others.map((e) => e.id)]);
+  }
+  const models = entries.filter((e) => MODEL_FORMATS.includes(e.format));
+  if (!models.length) return true;
+
+  const tmp = archives.tempDir();
+  try {
+    let extracted = new Map();
+    try {
+      extracted = await archives.extractMany(file, models.map((e) => e.path), tmp);
+    } catch (err) {
+      console.warn(`Could not extract from archive (file ${file.id}):`, err.message);
+    }
     const geometry = [];
-    for (const row of rows) {
-      const abs = path.resolve(row.file_path);
+    for (const entry of models) {
+      const abs = extracted.get(entry.path);
       try {
-        if (!fs.existsSync(abs)) {
-          await db.query(`UPDATE files SET fingerprinted_at = now(), geometry_status = 'missing' WHERE id = $1`, [row.id]);
+        if (!abs) {
+          await db.query(`UPDATE archive_entries SET fingerprinted_at = now(), geometry_status = 'error' WHERE id = $1`, [entry.id]);
           continue;
         }
-        if (!row.fingerprinted_at) {
-          await db.query('UPDATE files SET sha256 = $2, fingerprinted_at = now() WHERE id = $1',
-            [row.id, await sha256File(abs)]);
+        if (!entry.fingerprinted_at) {
+          await db.query('UPDATE archive_entries SET sha256 = $2, fingerprinted_at = now() WHERE id = $1',
+            [entry.id, await sha256File(abs)]);
         }
-        if (!GEOMETRY_FORMATS.includes(row.format)) {
-          await db.query(`UPDATE files SET geometry_status = 'na' WHERE id = $1`, [row.id]);
+        if (!GEOMETRY_FORMATS.includes(entry.format)) {
+          await db.query(`UPDATE archive_entries SET geometry_status = 'na' WHERE id = $1`, [entry.id]);
         } else if (pythonAvailable) {
-          geometry.push(row);
+          geometry.push({ id: entry.id, format: entry.format, abs });
         }
       } catch (err) {
-        console.warn(`Fingerprint failed for file ${row.id}:`, err.message);
-        await db.query(`UPDATE files SET fingerprinted_at = now(), geometry_status = 'error' WHERE id = $1`, [row.id]);
+        console.warn(`Fingerprint failed for archive entry ${entry.id}:`, err.message);
+        await db.query(`UPDATE archive_entries SET fingerprinted_at = now(), geometry_status = 'error' WHERE id = $1`, [entry.id]);
       }
     }
+    if (geometry.length) await withPython(() => fingerprintGeometry(geometry, 'archive_entries'));
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+  return true;
+}
 
-    if (geometry.length) {
-      try {
-        await fingerprintGeometry(geometry);
-      } catch (err) {
-        if (err.code !== 'ENOENT') throw err;
-        pythonAvailable = false;
-        console.warn(`Geometry fingerprints disabled: no Python at ${PYTHON} (content hashes still run).`);
-      }
-    }
+async function run() {
+  for (;;) {
+    const worked = [await fingerprintFiles(), await indexArchives(), await fingerprintEntries()];
+    if (!worked.some(Boolean)) return;
   }
 }
 
@@ -133,9 +227,12 @@ function kick() {
 
 async function pendingCount() {
   const { rows } = await db.query(
-    `SELECT COUNT(*)::int AS n FROM files
-     WHERE fingerprinted_at IS NULL OR (geometry_status IS NULL AND $1::boolean)`, [pythonAvailable]);
-  return rows[0].n;
+    `SELECT (SELECT COUNT(*) FROM files
+             WHERE fingerprinted_at IS NULL OR (geometry_status IS NULL AND $1::boolean))
+          + (SELECT COUNT(*) FROM files WHERE format = ANY($2) AND archive_status IS NULL)
+          + (SELECT COUNT(*) FROM archive_entries e WHERE ${ENTRY_PENDING}) AS n`,
+    [pythonAvailable, ARCHIVE_FORMATS]);
+  return Number(rows[0].n);
 }
 
 module.exports = { kick, pendingCount, geometryKey, sha256File };
diff --git a/lib/store.js b/lib/store.js
index 4144118..a18aa21 100644
--- a/lib/store.js
+++ b/lib/store.js
@@ -1,4 +1,5 @@
 const db = require('./db');
+const { MODEL_FORMATS, ARCHIVE_FORMATS } = require('./fileProcessor');
 
 // ---- shared SELECT that hydrates a model with tags, projects, files, designer ----
 const MODEL_SELECT = `
@@ -25,7 +26,8 @@ const MODEL_SELECT = `
     SELECT json_agg(json_build_object(
       'id', fl.id, 'originalName', fl.original_name, 'fileName', fl.file_name,
       'format', fl.format, 'size', fl.size, 'volume', fl.volume,
-      'bbox', fl.bbox, 'facets', fl.facets) ORDER BY fl.id) AS files
+      'bbox', fl.bbox, 'facets', fl.facets, 'archiveStatus', fl.archive_status,
+      'entryCount', (SELECT COUNT(*)::int FROM archive_entries ae WHERE ae.file_id = fl.id)) ORDER BY fl.id) AS files
     FROM files fl WHERE fl.model_id = m.id
   ) f ON true
 `;
@@ -116,17 +118,60 @@ async function updateModel(id, updates) {
 
 // Returns the on-disk file rows so the caller can unlink them.
 async function deleteModel(id) {
-  const { rows } = await db.query('SELECT file_path, glb_path FROM files WHERE model_id = $1', [id]);
+  const { rows } = await db.query('SELECT id, file_path, glb_path FROM files WHERE model_id = $1', [id]);
+  const entries = await db.query(
+    'SELECT e.id FROM archive_entries e JOIN files f ON f.id = e.file_id WHERE f.model_id = $1', [id]);
   const model = await db.query('SELECT thumbnail_path FROM models WHERE id = $1', [id]);
   const result = await db.query('DELETE FROM models WHERE id = $1 RETURNING id', [id]);
   if (result.rowCount === 0) return null;
   return {
+    fileIds: rows.map((r) => r.id),
     filePaths: rows.map((r) => r.file_path),
-    glbPaths: rows.map((r) => r.glb_path).filter(Boolean),
+    glbPaths: [
+      ...rows.map((r) => r.glb_path).filter(Boolean),
+      ...entries.rows.map((e) => `glb/entry-${e.id}.glb`),
+    ],
     thumbnailPath: model.rows[0] && model.rows[0].thumbnail_path,
   };
 }
 
+// ---------------------------------------------------------------- files / archive entries
+async function getFile(id) {
+  const { rows } = await db.query('SELECT * FROM files WHERE id = $1', [id]);
+  return rows[0] || null;
+}
+
+async function getArchiveEntries(fileId) {
+  const { rows } = await db.query(
+    'SELECT id, path, format, size FROM archive_entries WHERE file_id = $1 ORDER BY path', [fileId]);
+  return rows.map((r) => ({ ...r, size: Number(r.size) }));
+}
+
+// An entry plus the archive it lives in ({ id, file_path, format }).
+async function getArchiveEntry(id) {
+  const { rows } = await db.query(
+    `SELECT e.id, e.file_id, e.path, e.format, e.size, f.file_path, f.format AS archive_format
+     FROM archive_entries e JOIN files f ON f.id = e.file_id WHERE e.id = $1`, [id]);
+  const r = rows[0];
+  if (!r) return null;
+  return {
+    id: r.id, file_id: r.file_id, path: r.path, format: r.format, size: Number(r.size),
+    archive: { id: r.file_id, file_path: r.file_path, format: r.archive_format },
+  };
+}
+
+async function replaceArchiveEntries(fileId, entries) {
+  await db.transaction(async (client) => {
+    await client.query('DELETE FROM archive_entries WHERE file_id = $1', [fileId]);
+    if (!entries.length) return;
+    await client.query(
+      `INSERT INTO archive_entries (file_id, path, format, size)
+       SELECT $1::int, * FROM unnest($2::text[], $3::text[], $4::bigint[])
+       ON CONFLICT (file_id, path) DO NOTHING`,
+      [fileId, entries.map((e) => e.path), entries.map((e) => e.format), entries.map((e) => e.size)]);
+  });
+}
+
 // ---------------------------------------------------------------- trash
 async function trashModels(ids) {
   const { rowCount } = await db.query(
@@ -153,21 +198,42 @@ async function countTrashed() {
 // ---------------------------------------------------------------- duplicates
 // Files of non-trashed models whose content hash or geometry fingerprint also
 // appears in another non-trashed model — the input to the duplicate finder.
+// Ids are prefixed ('f12' for a file, 'e7' for an archive entry) so both kinds
+// can be matched together. Pictures and documents never count.
 async function duplicateCandidateFiles() {
   const { rows } = await db.query(`
     WITH live AS (
-      SELECT f.id, f.model_id, f.sha256, f.geometry_hash
+      SELECT 'f' || f.id AS id, f.model_id, f.sha256, f.geometry_hash
       FROM files f JOIN models m ON m.id = f.model_id
-      WHERE m.deleted_at IS NULL AND f.size > 0
+      WHERE m.deleted_at IS NULL AND f.size > 0 AND f.format = ANY($1)
+      UNION ALL
+      SELECT 'e' || e.id, f.model_id, e.sha256, e.geometry_hash
+      FROM archive_entries e JOIN files f ON f.id = e.file_id JOIN models m ON m.id = f.model_id
+      WHERE m.deleted_at IS NULL AND e.size > 0 AND e.format = ANY($2)
     )
     SELECT * FROM live
     WHERE sha256 IN (SELECT sha256 FROM live WHERE sha256 IS NOT NULL
                      GROUP BY sha256 HAVING COUNT(DISTINCT model_id) > 1)
        OR geometry_hash IN (SELECT geometry_hash FROM live WHERE geometry_hash IS NOT NULL
-                            GROUP BY geometry_hash HAVING COUNT(DISTINCT model_id) > 1)`);
+                            GROUP BY geometry_hash HAVING COUNT(DISTINCT model_id) > 1)`,
+  [[...MODEL_FORMATS, ...ARCHIVE_FORMATS], MODEL_FORMATS]);
   return rows;
 }
 
+// How many duplicate-matchable items (model files, archives, models inside
+// archives) each model holds: { modelId: n }.
+async function matchableCounts(modelIds) {
+  if (!modelIds.length) return {};
+  const { rows } = await db.query(`
+    SELECT m.id,
+      (SELECT COUNT(*) FROM files f WHERE f.model_id = m.id AND f.format = ANY($2))
+      + (SELECT COUNT(*) FROM archive_entries e JOIN files f ON f.id = e.file_id
+         WHERE f.model_id = m.id AND e.format = ANY($3)) AS n
+    FROM models m WHERE m.id = ANY($1::int[])`,
+  [modelIds, [...MODEL_FORMATS, ...ARCHIVE_FORMATS], MODEL_FORMATS]);
+  return Object.fromEntries(rows.map((r) => [r.id, Number(r.n)]));
+}
+
 // Keep one model of a duplicate group: fold the others' tags, collections and
 // notes into it, then move the others to the trash.
 async function mergeAndTrash(keepId, otherIds) {
@@ -407,7 +473,8 @@ module.exports = {
   getAllModels, getModel, getModelsByIds, findModelBySource, createModel, updateModel, deleteModel, addFiles,
   updateFileConversion,
   trashModels, restoreModel, trashedModelIds, countTrashed,
-  duplicateCandidateFiles, mergeAndTrash, dismissDuplicateGroup, dismissedDuplicateSignatures,
+  duplicateCandidateFiles, matchableCounts, mergeAndTrash, dismissDuplicateGroup, dismissedDuplicateSignatures,
+  getFile, getArchiveEntries, getArchiveEntry, replaceArchiveEntries,
   getAllTags,
   getAllProjects, getProject, createProject, updateProject, deleteProject,
   getSetting, setSetting,
diff --git a/package-lock.json b/package-lock.json
index f1e5660..c829c8d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
+        "7z-wasm": "^1.2.0",
         "adm-zip": "^0.5.17",
         "bcryptjs": "^3.0.3",
         "cookie-parser": "^1.4.7",
@@ -18,12 +19,42 @@
         "multer": "^1.4.5-lts.1",
         "node-stl": "^0.7.0",
         "nodemailer": "^9.0.1",
-        "pg": "^8.22.0"
+        "occt-import-js": "^0.0.23",
+        "pg": "^8.22.0",
+        "rhino3dm": "^8.32.2",
+        "tar": "^7.5.22"
       },
       "devDependencies": {
         "nodemon": "^3.0.2"
       }
     },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/7z-wasm": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/7z-wasm/-/7z-wasm-1.2.0.tgz",
+      "integrity": "sha512-AZjtWXFleAe5nQ27JYISs70cICjO0zZr4LU45I9pXKcrhG0qiEWgq3Vjwr9JHHihFLuqgc7uSHYVn/z3vXCjdw==",
+      "license": "SEE LICENSE IN License.txt",
+      "dependencies": {
+        "readline-sync": "^1.4.10"
+      },
+      "bin": {
+        "7z-wasm": "bin/cli"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -240,6 +271,15 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/concat-stream": {
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
@@ -945,6 +985,27 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/mkdirp": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
@@ -1091,6 +1152,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/occt-import-js": {
+      "version": "0.0.23",
+      "resolved": "https://registry.npmjs.org/occt-import-js/-/occt-import-js-0.0.23.tgz",
+      "integrity": "sha512-RFfYQXYFX5C1mB1Aywm0ShcUKzXOr/VzTnlzhBSDJOR6YCAPt1HYCzeXWg1vwwjn/cUxwqRNhhtf1dlewoZYCQ==",
+      "license": "LGPL-2.1"
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -1358,6 +1425,21 @@
         "node": ">=8.10.0"
       }
     },
+    "node_modules/readline-sync": {
+      "version": "1.4.10",
+      "resolved": "https://registry.npmjs.org/readline-sync/-/readline-sync-1.4.10.tgz",
+      "integrity": "sha512-gNva8/6UAe8QYepIQH/jQ2qn91Qj0B9sYjMBBs3QOB8F2CXcKgLxQaJRP76sWVRQt+QU+8fAkCbCvjjMFu7Ycw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/rhino3dm": {
+      "version": "8.32.2",
+      "resolved": "https://registry.npmjs.org/rhino3dm/-/rhino3dm-8.32.2.tgz",
+      "integrity": "sha512-Q3/5iHIKJeoE5doXrRy7C1vJer4F8uMYe8K6B8VQHqhGj5BCS1L3EkqNpKyUTERoHyKh7rMmiiZpw9iEUkCnPQ==",
+      "license": "MIT"
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -1586,6 +1668,22 @@
         "node": ">=4"
       }
     },
+    "node_modules/tar": {
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -1685,6 +1783,15 @@
       "engines": {
         "node": ">=0.4"
       }
+    },
+    "node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index 91e1354..e348bd7 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
+    "7z-wasm": "^1.2.0",
     "adm-zip": "^0.5.17",
     "bcryptjs": "^3.0.3",
     "cookie-parser": "^1.4.7",
@@ -26,7 +27,10 @@
     "multer": "^1.4.5-lts.1",
     "node-stl": "^0.7.0",
     "nodemailer": "^9.0.1",
-    "pg": "^8.22.0"
+    "occt-import-js": "^0.0.23",
+    "pg": "^8.22.0",
+    "rhino3dm": "^8.32.2",
+    "tar": "^7.5.22"
   },
   "devDependencies": {
     "nodemon": "^3.0.2"
diff --git a/public/app.js b/public/app.js
index ef0f2a5..9fb77fa 100644
--- a/public/app.js
+++ b/public/app.js
@@ -189,8 +189,8 @@ async function generateMissingThumbnails() {
     if (!file) continue;
     thumbAttempted.add(m.id);
     try {
-      const src = viewerSourceFor(file.id, file.format);
-      const image = await window.ModelViewer.snapshot(src.url, src.format, 512);
+      const src = viewerSourceFor({ kind: 'file', id: file.id, format: file.format });
+      const image = await window.ModelViewer.snapshot(src.url, src.format, 512, { resolve: resolverFor(m) });
       if (!image) continue;
       const res = await fetch(`/api/models/${m.id}/thumbnail`, {
         method: 'POST',
@@ -484,7 +484,7 @@ function duplicateGroupHtml(g) {
 
 function duplicateCardHtml(g, m) {
   const recommended = m.id === g.recommendedId;
-  const unique = m.files.length - m.matchedFiles;
+  const unique = m.matchableFiles - m.matchedFiles;
   return `
     <div class="dup-card${recommended ? ' recommended' : ''}" data-model-id="${m.id}">
       <div class="file-thumbnail">${thumbHtml(m)}</div>
@@ -492,7 +492,7 @@ function duplicateCardHtml(g, m) {
         ${recommended ? '<span class="rec-badge">Recommended keep</span>' : ''}
         <div class="file-name" title="${escapeHtml(m.name)}">${escapeHtml(m.name)}</div>
         <div class="file-meta">${escapeHtml(sourceLabel(sourceKey(m)))} • ${formatDate(m.date_added)}</div>
-        <div class="file-meta">${m.matchedFiles} of ${m.files.length} files match${unique ? ` • <span class="warn">${unique} unique</span>` : ''}</div>
+        <div class="file-meta">${m.matchedFiles} of ${m.matchableFiles} files match${unique ? ` • <span class="warn">${unique} unique</span>` : ''}</div>
         <button class="btn btn-primary btn-sm" data-action="keep">Keep this one</button>
       </div>
     </div>`;
@@ -505,7 +505,7 @@ async function handleKeepDuplicate(signature, keepId) {
   const others = group.models.filter((m) => m.id !== keepId);
   let message = `Keep "${keep.name}" and move ${others.length} other model${others.length === 1 ? '' : 's'} to the trash?\n\n`
     + 'Their tags, collections and notes are merged into the one you keep.';
-  const withUnique = others.filter((m) => m.files.length > m.matchedFiles);
+  const withUnique = others.filter((m) => m.matchableFiles > m.matchedFiles);
   if (withUnique.length) {
     message += `\n\nHeads up: ${withUnique.map((m) => `"${m.name}"`).join(', ')} also contain files that aren't duplicated — they go to the trash too.`;
   }
@@ -700,6 +700,22 @@ function setupEventListeners() {
   });
   document.getElementById('detailNotes').addEventListener('input', queueNotesSave);
   document.getElementById('detailNotes').addEventListener('blur', flushNotes);
+  document.getElementById('detailFileTabs').addEventListener('click', (e) => {
+    const tab = e.target.closest('.file-tab');
+    const item = tab && detailItems.find((i) => itemKey(i) === tab.dataset.key);
+    if (!item) return;
+    renderViewerTabs(itemKey(item));
+    loadViewer(item);
+  });
+  document.getElementById('detailFileInfo').addEventListener('click', (e) => {
+    const btn = e.target.closest('[data-view-entry]');
+    if (!btn) return;
+    const archiveId = Number(btn.dataset.archive);
+    const entry = (archiveEntryCache.get(archiveId) || []).find((x) => String(x.id) === btn.dataset.viewEntry);
+    if (!entry) return;
+    openViewerItem({ kind: 'entry', id: entry.id, format: entry.format, name: entry.path.split('/').pop(), archiveId });
+    document.getElementById('detailViewer').scrollIntoView({ block: 'nearest', behavior: 'smooth' });
+  });
 
   setupTagAutocomplete(document.getElementById('fileTags'));
   setupTagAutocomplete(document.getElementById('editTags'));
@@ -924,38 +940,98 @@ function openModelDetail(modelId) {
       <div class="file-row">
         <span>${escapeHtml(f.originalName)} <em>(${formatFileSize(f.size)}${f.volume ? `, ${Number(f.volume).toFixed(2)} cm³` : ''})</em></span>
         <a href="/api/files/${f.id}/raw" download>download</a>
-      </div>`).join('');
+      </div>
+      ${ARCHIVE_FORMATS.includes(f.format) ? `<div class="entry-list" data-entries-for="${f.id}"><div class="entry-head">Reading archive…</div></div>` : ''}`).join('');
+    model.files.filter((f) => ARCHIVE_FORMATS.includes(f.format)).forEach((f) => loadArchiveEntries(model.id, f.id));
   }
 
-  // Viewer tabs
-  const renderable = model.files.filter((f) => window.ModelViewer.RENDERABLE.includes(f.format));
-  const tabs = document.getElementById('detailFileTabs');
-  tabs.innerHTML = renderable.map((f, i) => `
-    <button class="file-tab${i === 0 ? ' active' : ''}" data-file-id="${f.id}" data-format="${f.format}">${escapeHtml(f.originalName)}</button>`).join('');
-  tabs.querySelectorAll('.file-tab').forEach((tab) => {
-    tab.addEventListener('click', () => {
-      tabs.querySelectorAll('.file-tab').forEach((t) => t.classList.remove('active'));
-      tab.classList.add('active');
-      loadViewer(tab.dataset.fileId, tab.dataset.format);
-    });
-  });
+  // Viewer tabs: 3D files first, then pictures/PDFs/text (entries inside
+  // archives get a tab when opened from the file list).
+  const { RENDERABLE, DOCUMENT_FORMATS } = window.ModelViewer;
+  detailItems = [
+    ...model.files.filter((f) => RENDERABLE.includes(f.format)),
+    ...model.files.filter((f) => DOCUMENT_FORMATS.includes(f.format) && f.format !== 'mtl'),
+  ].map((f) => ({ kind: 'file', id: f.id, format: f.format, name: f.originalName }));
+  renderViewerTabs(detailItems.length ? itemKey(detailItems[0]) : null);
 
   fileDetailModal.classList.add('active');
   currentDetailFile = null;
-  if (renderable.length) {
-    loadViewer(renderable[0].id, renderable[0].format);
+  if (detailItems.length) {
+    loadViewer(detailItems[0]);
   } else {
     document.getElementById('regenThumbBtn').style.display = 'none';
     window.ModelViewer.render(document.getElementById('detailViewer'), '', 'none', { fallbackImage: currentDetailThumb });
   }
 }
 
-// Maps a file to what the viewer should load: 3MF goes through the server's
-// GLB conversion; everything else is served raw.
-function viewerSourceFor(fileId, format) {
-  return format === '3mf'
-    ? { url: `/api/files/${fileId}/glb`, format: 'glb' }
-    : { url: `/api/files/${fileId}/raw`, format };
+// ---------------------------------------------------------------- viewer items
+// An item is something the viewer can show: { kind: 'file' | 'entry', id, format, name, archiveId? }.
+const ARCHIVE_FORMATS = ['zip', '7z', 'rar', 'tar', 'tgz'];
+let detailItems = [];
+const archiveEntryCache = new Map(); // archive file id -> entries
+const itemKey = (item) => `${item.kind}:${item.id}`;
+
+function renderViewerTabs(activeKey) {
+  document.getElementById('detailFileTabs').innerHTML = detailItems.map((item) => `
+    <button class="file-tab${itemKey(item) === activeKey ? ' active' : ''}" data-key="${itemKey(item)}">${escapeHtml(item.name)}</button>`).join('');
+}
+
+function openViewerItem(item) {
+  if (!detailItems.some((i) => itemKey(i) === itemKey(item))) detailItems.push(item);
+  renderViewerTabs(itemKey(item));
+  loadViewer(item);
+}
+
+// What the viewer should load: 3MF goes through the server's GLB conversion,
+// documents are served inline, everything else raw.
+function viewerSourceFor(item) {
+  const base = `/api/${item.kind === 'entry' ? 'entries' : 'files'}/${item.id}`;
+  if (item.format === '3mf') return { url: `${base}/glb`, format: 'glb' };
+  if (window.ModelViewer.DOCUMENT_FORMATS.includes(item.format)) return { url: `${base}/raw?inline=1`, format: item.format };
+  return { url: `${base}/raw`, format: item.format };
+}
+
+// Finds files shipped alongside a model by name — OBJ materials, FBX/MTL
+// textures. Entries of the same archive win, then the model's own files.
+function resolverFor(model, archiveEntries = null) {
+  const byName = new Map();
+  const key = (name) => String(name).split(/[\\/]/).pop().toLowerCase();
+  const add = (name, url) => { if (!byName.has(key(name))) byName.set(key(name), url); };
+  (archiveEntries || []).forEach((e) => add(e.path, `/api/entries/${e.id}/raw`));
+  ((model && model.files) || []).forEach((f) => add(f.originalName, `/api/files/${f.id}/raw`));
+  return (name) => byName.get(key(name)) || null;
+}
+
+async function loadArchiveEntries(modelId, fileId) {
+  const container = () => (fileDetailModal.dataset.currentModelId === String(modelId)
+    ? document.querySelector(`[data-entries-for="${fileId}"]`) : null);
+  try {
+    const res = await fetch(`/api/files/${fileId}/entries`);
+    const data = await res.json();
+    if (!res.ok) throw new Error(data.error);
+    if (!container()) return;
+    if (data.status === 'pending') {
+      setTimeout(() => { if (container()) loadArchiveEntries(modelId, fileId); }, 2000);
+      return;
+    }
+    if (data.status === 'error') {
+      container().innerHTML = `<div class="entry-head">Couldn't read this archive: ${escapeHtml(data.error || 'unknown error')}</div>`;
+      return;
+    }
+    archiveEntryCache.set(fileId, data.entries);
+    const { PREVIEWABLE } = window.ModelViewer;
+    container().innerHTML = `<div class="entry-head">${data.entries.length} file${data.entries.length === 1 ? '' : 's'} inside</div>`
+      + data.entries.map((e) => `
+      <div class="entry-row">
+        <span title="${escapeHtml(e.path)}">${escapeHtml(e.path.replace(/^\.\//, ''))} <em>${formatFileSize(e.size)}</em></span>
+        <span class="row-actions">
+          ${PREVIEWABLE.includes(e.format) && e.format !== 'mtl' ? `<button type="button" class="link-btn" data-view-entry="${e.id}" data-archive="${fileId}">view</button>` : ''}
+          <a href="/api/entries/${e.id}/raw" download>download</a>
+        </span>
+      </div>`).join('');
+  } catch (err) {
+    if (container()) container().innerHTML = `<div class="entry-head">Couldn't list this archive: ${escapeHtml(err.message)}</div>`;
+  }
 }
 
 function renderDetailLicense(model) {
@@ -1068,11 +1144,15 @@ async function handleRefreshMetadata() {
   }
 }
 
-function loadViewer(fileId, format) {
-  const src = viewerSourceFor(fileId, format);
-  currentDetailFile = { id: fileId, viewerUrl: src.url, viewerFormat: src.format };
-  document.getElementById('regenThumbBtn').style.display = '';
-  window.ModelViewer.render(document.getElementById('detailViewer'), src.url, src.format, { fallbackImage: currentDetailThumb });
+function loadViewer(item) {
+  const src = viewerSourceFor(item);
+  const model = findModel(fileDetailModal.dataset.currentModelId);
+  const resolve = resolverFor(model, item.kind === 'entry' ? archiveEntryCache.get(item.archiveId) : null);
+  const is3d = window.ModelViewer.MODEL_FORMATS.includes(src.format);
+  currentDetailFile = is3d ? { viewerUrl: src.url, viewerFormat: src.format, resolve } : null;
+  document.getElementById('regenThumbBtn').style.display = is3d ? '' : 'none';
+  window.ModelViewer.render(document.getElementById('detailViewer'), src.url, src.format,
+    { fallbackImage: currentDetailThumb, resolve });
 }
 
 function updateCardThumbnail(modelId, thumbnailUrl) {
@@ -1089,7 +1169,8 @@ async function handleRegenThumbnail() {
   btn.disabled = true;
   btn.textContent = 'Rendering…';
   try {
-    const image = await window.ModelViewer.snapshot(currentDetailFile.viewerUrl, currentDetailFile.viewerFormat, 512);
+    const image = await window.ModelViewer.snapshot(currentDetailFile.viewerUrl, currentDetailFile.viewerFormat, 512,
+      { resolve: currentDetailFile.resolve });
     const res = await fetch(`/api/models/${modelId}/thumbnail`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
diff --git a/public/index.html b/public/index.html
index 92fd9c0..e38ceb1 100644
--- a/public/index.html
+++ b/public/index.html
@@ -329,8 +329,8 @@
       <div class="modal-body">
         <form id="uploadForm">
           <div class="form-group">
-            <label for="fileInput">Files * <span class="form-hint-inline">(stl, 3mf, obj, step, gcode, zip — multiple allowed)</span></label>
-            <input type="file" id="fileInput" accept=".stl,.3mf,.obj,.step,.stp,.gcode,.gco,.zip" multiple required>
+            <label for="fileInput">Files * <span class="form-hint-inline">(models, archives, pictures, PDFs &amp; readmes — multiple allowed)</span></label>
+            <input type="file" id="fileInput" accept=".stl,.3mf,.obj,.fbx,.step,.stp,.3dm,.gcode,.gco,.zip,.7z,.rar,.tar,.tgz,.gz,.jpg,.jpeg,.png,.gif,.webp,.bmp,.svg,.pdf,.txt,.md,.mtl" multiple required>
           </div>
 
           <div class="form-group">
@@ -448,7 +448,7 @@
               <button type="button" class="btn btn-secondary btn-sm" id="downloadFilesBtn" style="margin-top:10px; display:none"></button>
             </div>
             <input type="file" id="addFilesInput" multiple style="display:none"
-                   accept=".stl,.3mf,.obj,.step,.stp,.gcode,.gco,.zip">
+                   accept=".stl,.3mf,.obj,.fbx,.step,.stp,.3dm,.gcode,.gco,.zip,.7z,.rar,.tar,.tgz,.gz,.jpg,.jpeg,.png,.gif,.webp,.bmp,.svg,.pdf,.txt,.md,.mtl">
             <div class="form-actions" id="detailActions">
               <button class="btn btn-danger" id="deleteFileBtn">Move to trash</button>
               <button class="btn btn-secondary" id="addFilesBtn">Add files</button>
diff --git a/public/styles.css b/public/styles.css
index dbf8fd0..12c4c34 100644
--- a/public/styles.css
+++ b/public/styles.css
@@ -214,6 +214,20 @@ label { display: block; font-size: 13px; font-weight: 500; color: var(--text-mut
 .viewer-fallback img { max-width: 100%; max-height: 320px; object-fit: contain; border-radius: var(--radius-sm); }
 .viewer-fallback span { color: var(--text-dim); font-size: 12px; text-align: center; }
 
+.viewer-image { max-width: 100%; max-height: 100%; object-fit: contain; }
+.viewer-pdf, .viewer-text { align-self: stretch; width: 100%; height: 100%; border: 0; border-radius: var(--radius); }
+.viewer-pdf { background: #fff; }
+.viewer-text { margin: 0; padding: 14px 16px; overflow: auto; font-family: var(--mono); font-size: 12px; line-height: 1.55; color: var(--text); white-space: pre-wrap; word-break: break-word; text-align: left; }
+
+.info-section .entry-list { margin: 2px 0 8px 10px; padding-left: 12px; border-left: 1px solid var(--border); max-height: 260px; overflow-y: auto; }
+.info-section .entry-head { font-size: 12px; color: var(--text-dim); margin: 6px 0 2px; }
+.info-section .entry-row { display: flex; justify-content: space-between; align-items: center; gap: 10px; padding: 3px 0; font-size: 13px; color: var(--text-muted); }
+.entry-row > span:first-child { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; }
+.entry-row em { color: var(--text-dim); font-style: normal; font-family: var(--mono); font-size: 11px; margin-left: 4px; }
+.row-actions { display: flex; gap: 12px; flex-shrink: 0; align-items: center; }
+.link-btn { background: none; border: none; color: var(--accent); font: inherit; cursor: pointer; padding: 0; }
+.link-btn:hover { text-decoration: underline; }
+
 .file-tabs { display: flex; flex-wrap: wrap; gap: 6px; }
 .file-tab { border: 1px solid var(--border); background: var(--surface-2); color: var(--text-muted); padding: 5px 11px; border-radius: var(--radius-sm); font-size: 12px; cursor: pointer; font-family: inherit; }
 .file-tab:hover { color: var(--text); }
diff --git a/public/viewer.js b/public/viewer.js
index 922973e..c4c0251 100644
--- a/public/viewer.js
+++ b/public/viewer.js
@@ -1,16 +1,27 @@
-// In-browser 3D preview for STL / 3MF / OBJ files, loaded as an ES module.
+// In-browser preview for 3D models (STL, OBJ + MTL, 3MF via GLB, FBX, STEP, 3DM)
+// and for the pictures, PDFs and text files that come with them.
 import * as THREE from 'three';
 import { OrbitControls } from 'three/addons/controls/OrbitControls.js';
 import { STLLoader } from 'three/addons/loaders/STLLoader.js';
 import { OBJLoader } from 'three/addons/loaders/OBJLoader.js';
-import { ThreeMFLoader } from 'three/addons/loaders/3MFLoader.js';
+import { MTLLoader } from 'three/addons/loaders/MTLLoader.js';
+import { FBXLoader } from 'three/addons/loaders/FBXLoader.js';
 import { GLTFLoader } from 'three/addons/loaders/GLTFLoader.js';
+import { Rhino3dmLoader } from 'three/addons/loaders/3DMLoader.js';
+
+// Formats the 3D renderer draws directly (3MF arrives as a server-converted GLB).
+const MODEL_FORMATS = ['stl', 'obj', 'glb', 'fbx', '3dm', 'step', 'stp'];
+const IMAGE_FORMATS = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp', 'svg'];
+const TEXT_FORMATS = ['txt', 'md', 'mtl'];
+const DOCUMENT_FORMATS = [...IMAGE_FORMATS, 'pdf', ...TEXT_FORMATS];
+// What the app offers a preview for.
+const RENDERABLE = ['stl', '3mf', 'obj', 'fbx', '3dm', 'step', 'stp'];
+const PREVIEWABLE = [...RENDERABLE, ...DOCUMENT_FORMATS];
+// Formats authored Z-up; turned to sit upright in three.js's Y-up world.
+const Z_UP = ['stl', 'glb', '3dm', 'step', 'stp'];
 
-// Formats the renderer can draw directly. 3MF is rendered via server-converted
-// GLB (see RENDERABLE for what the app treats as previewable input).
-const SUPPORTED = ['stl', 'obj', 'glb'];
-const RENDERABLE = ['stl', '3mf', 'obj'];
 let active = null; // { renderer, controls, rafId }
+let renderToken = 0; // bumps on every render, so a slow earlier load can't draw over a newer one
 
 function dispose() {
   if (!active) return;
@@ -26,8 +37,7 @@ function message(container, text) {
   container.innerHTML = `<div class="viewer-msg">${text}</div>`;
 }
 
-// When 3D rendering isn't possible (e.g. Bambu/MakerWorld 3MF project files that
-// the loader can't parse), show the model's preview image instead of an error.
+// When 3D rendering isn't possible, show the model's preview image instead of an error.
 function showFallback(container, image, text) {
   if (image) {
     container.innerHTML =
@@ -37,33 +47,172 @@ function showFallback(container, image, text) {
   }
 }
 
-async function loadObject(url, format) {
+async function fetchOk(url) {
+  const res = await fetch(url);
+  if (!res.ok) throw new Error(`HTTP ${res.status} loading ${url}`);
+  return res;
+}
+
+const basename = (p) => String(p).split(/[\\/]/).pop();
+
+function defaultMaterial(color) {
+  return new THREE.MeshStandardMaterial({ color: color || 0xc4cad6, metalness: 0.15, roughness: 0.65 });
+}
+
+// A loading manager that points material and texture references ("wood.png",
+// "../tex/wood.png") at the files shipped alongside the model. `own` is the
+// URL being loaded itself, which is left alone.
+function managerFor(resolve, own) {
+  const manager = new THREE.LoadingManager();
+  if (resolve) {
+    manager.setURLModifier((url) => {
+      if (url === own || url.startsWith('blob:') || url.startsWith('data:')) return url;
+      return resolve(decodeURIComponent(basename(url.split('?')[0]))) || url;
+    });
+  }
+  return manager;
+}
+
+async function loadObj(url, resolve) {
+  const text = await (await fetchOk(url)).text();
+  const loader = new OBJLoader();
+  const mtllib = /^mtllib\s+(.+)$/m.exec(text);
+  const mtlUrl = mtllib && resolve ? resolve(basename(mtllib[1].trim())) : null;
+  let textured = false;
+  if (mtlUrl) {
+    try {
+      const materials = await new MTLLoader(managerFor(resolve, mtlUrl)).loadAsync(mtlUrl);
+      materials.preload();
+      loader.setMaterials(materials);
+      textured = true;
+    } catch { /* fall back to plain grey */ }
+  }
+  const object = loader.parse(text);
+  if (!textured) object.traverse((c) => { if (c.isMesh) c.material = defaultMaterial(); });
+  return object;
+}
+
+// OpenCascade (WASM) is large, so it's fetched the first time a STEP file is opened.
+let occtPromise = null;
+function occt() {
+  if (!occtPromise) {
+    occtPromise = new Promise((resolve, reject) => {
+      const script = document.createElement('script');
+      script.src = '/vendor/occt/occt-import-js.js';
+      script.onload = () => resolve(window.occtimportjs({ locateFile: (name) => `/vendor/occt/${name}` }));
+      script.onerror = () => { occtPromise = null; reject(new Error('Could not load the STEP reader')); };
+      document.head.appendChild(script);
+    });
+  }
+  return occtPromise;
+}
+
+async function loadStep(url) {
+  const [reader, buffer] = await Promise.all([occt(), fetchOk(url).then((r) => r.arrayBuffer())]);
+  const result = reader.ReadStepFile(new Uint8Array(buffer), null);
+  if (!result.success || !result.meshes.length) throw new Error('No geometry in this STEP file');
+  const group = new THREE.Group();
+  for (const m of result.meshes) {
+    const geometry = new THREE.BufferGeometry();
+    geometry.setAttribute('position', new THREE.Float32BufferAttribute(m.attributes.position.array, 3));
+    if (m.attributes.normal) geometry.setAttribute('normal', new THREE.Float32BufferAttribute(m.attributes.normal.array, 3));
+    geometry.setIndex(Array.from(m.index.array));
+    if (!m.attributes.normal) geometry.computeVertexNormals();
+    const color = m.color ? new THREE.Color(m.color[0], m.color[1], m.color[2]) : null;
+    group.add(new THREE.Mesh(geometry, defaultMaterial(color)));
+  }
+  return group;
+}
+
+async function load3dm(url) {
+  const loader = new Rhino3dmLoader().setLibraryPath('/vendor/rhino3dm/');
+  try {
+    return await loader.loadAsync(url);
+  } finally {
+    loader.dispose();
+  }
+}
+
+async function loadObject(url, format, opts = {}) {
+  let object;
   if (format === 'stl') {
     const geometry = await new STLLoader().loadAsync(url);
     geometry.computeVertexNormals();
-    const material = new THREE.MeshStandardMaterial({ color: 0xc4cad6, metalness: 0.15, roughness: 0.65 });
-    const mesh = new THREE.Mesh(geometry, material);
-    mesh.rotation.x = -Math.PI / 2; // STL is typically Z-up; sit it flat
-    return mesh;
+    object = new THREE.Mesh(geometry, defaultMaterial());
+  } else if (format === 'obj') {
+    object = await loadObj(url, opts.resolve);
+  } else if (format === 'fbx') {
+    object = await new FBXLoader(managerFor(opts.resolve, url)).loadAsync(url);
+  } else if (format === 'glb') {
+    object = (await new GLTFLoader().loadAsync(url)).scene;
+  } else if (format === '3dm') {
+    object = await load3dm(url);
+  } else if (format === 'step' || format === 'stp') {
+    object = await loadStep(url);
+  } else {
+    throw new Error(`Unsupported format ${format}`);
   }
-  if (format === 'obj') return new OBJLoader().loadAsync(url);
-  if (format === '3mf') return new ThreeMFLoader().loadAsync(url);
-  if (format === 'glb') {
-    const gltf = await new GLTFLoader().loadAsync(url);
-    gltf.scene.rotation.x = -Math.PI / 2; // 3MF/trimesh is Z-up; sit it upright
-    return gltf.scene;
+  if (Z_UP.includes(format)) object.rotation.x = -Math.PI / 2;
+  return object;
+}
+
+async function renderDocument(container, url, format, token) {
+  if (IMAGE_FORMATS.includes(format)) {
+    const img = document.createElement('img');
+    img.className = 'viewer-image';
+    img.alt = '';
+    img.src = url;
+    container.appendChild(img);
+  } else if (format === 'pdf') {
+    const frame = document.createElement('iframe');
+    frame.className = 'viewer-pdf';
+    frame.title = 'PDF preview';
+    frame.src = url;
+    container.appendChild(frame);
+  } else {
+    let text;
+    try {
+      text = await (await fetchOk(url)).text();
+    } catch {
+      text = 'Could not load this file.';
+    }
+    if (token !== renderToken) return;
+    const pre = document.createElement('pre');
+    pre.className = 'viewer-text';
+    pre.textContent = text.length > 200000 ? `${text.slice(0, 200000)}\n…` : text;
+    container.appendChild(pre);
   }
-  throw new Error(`Unsupported format ${format}`);
 }
 
 async function render(container, url, format, opts = {}) {
   dispose();
+  const token = ++renderToken;
   container.innerHTML = '';
-  if (!SUPPORTED.includes(format)) {
+  if (DOCUMENT_FORMATS.includes(format)) {
+    await renderDocument(container, url, format, token);
+    return;
+  }
+  if (!MODEL_FORMATS.includes(format)) {
     showFallback(container, opts.fallbackImage, `No 3D preview for .${format} files.`);
     return;
   }
 
+  message(container, 'Loading preview…');
+  let object;
+  try {
+    object = await loadObject(url, format, opts);
+  } catch (err) {
+    console.warn('Preview failed:', err);
+    if (token !== renderToken) return;
+    const note = format === 'glb'
+      ? 'Interactive 3D isn’t available for this 3MF.'
+      : 'This file couldn’t be rendered in 3D.';
+    showFallback(container, opts.fallbackImage, note);
+    return;
+  }
+  if (token !== renderToken) return; // another file was opened meanwhile
+
+  container.innerHTML = '';
   const width = container.clientWidth || 600;
   const height = container.clientHeight || 420;
 
@@ -81,20 +230,6 @@ async function render(container, url, format, opts = {}) {
   const controls = new OrbitControls(camera, renderer.domElement);
   controls.enableDamping = true;
 
-  let object;
-  try {
-    object = await loadObject(url, format);
-  } catch (err) {
-    renderer.dispose();
-    renderer.forceContextLoss();
-    if (renderer.domElement.parentNode) renderer.domElement.parentNode.removeChild(renderer.domElement);
-    const note = format === '3mf'
-      ? 'Interactive 3D isn’t supported for this 3MF (Bambu/MakerWorld project file).'
-      : 'This file couldn’t be rendered in 3D.';
-    showFallback(container, opts.fallbackImage, note);
-    return;
-  }
-
   // Center the object and frame the camera around it.
   const box = new THREE.Box3().setFromObject(object);
   const size = box.getSize(new THREE.Vector3());
@@ -123,8 +258,8 @@ async function render(container, url, format, opts = {}) {
 // Render a model once to an offscreen canvas and return a PNG data URL.
 // Used to generate card thumbnails. Transparent background so it composites
 // over the card surface.
-async function snapshot(url, format, size = 512) {
-  if (!SUPPORTED.includes(format)) return null;
+async function snapshot(url, format, size = 512, opts = {}) {
+  if (!MODEL_FORMATS.includes(format)) return null;
 
   const renderer = new THREE.WebGLRenderer({ antialias: true, alpha: true, preserveDrawingBuffer: true });
   renderer.setSize(size, size);
@@ -137,7 +272,7 @@ async function snapshot(url, format, size = 512) {
   const fill = new THREE.DirectionalLight(0xffffff, 0.35); fill.position.set(-1, 0.5, -1); scene.add(fill);
 
   try {
-    const object = await loadObject(url, format);
+    const object = await loadObject(url, format, opts);
     const box = new THREE.Box3().setFromObject(object);
     const dim = box.getSize(new THREE.Vector3());
     const center = box.getCenter(new THREE.Vector3());
@@ -159,4 +294,4 @@ async function snapshot(url, format, size = 512) {
   }
 }
 
-window.ModelViewer = { render, dispose, snapshot, SUPPORTED, RENDERABLE };
+window.ModelViewer = { render, dispose, snapshot, MODEL_FORMATS, DOCUMENT_FORMATS, RENDERABLE, PREVIEWABLE };
diff --git a/server.js b/server.js
index 8f266e6..55516e7 100644
--- a/server.js
+++ b/server.js
@@ -21,6 +21,7 @@ const auth = require('./lib/auth');
 const mailer = require('./lib/mailer');
 const fingerprint = require('./lib/fingerprint');
 const duplicates = require('./lib/duplicates');
+const archives = require('./lib/archives');
 
 const app = express();
 const PORT = process.env.PORT || 3000;
@@ -31,6 +32,9 @@ app.use(express.json({ limit: '8mb' })); // generous for base64 thumbnail PNGs
 app.use(cookieParser());
 app.use(express.static('public'));
 app.use('/thumbnails', express.static('thumbnails'));
+// In-browser readers for STEP (OpenCascade) and Rhino 3DM, served from node_modules.
+app.use('/vendor/occt', express.static(path.join(__dirname, 'node_modules/occt-import-js/dist')));
+app.use('/vendor/rhino3dm', express.static(path.join(__dirname, 'node_modules/rhino3dm')));
 
 // Gate the API: everything under /api requires auth except the bootstrap config
 // and the auth endpoints themselves.
@@ -57,11 +61,14 @@ function describeFile(filePath, fileName, originalName) {
   return { fileName, filePath, originalName, format, size, ...meta };
 }
 
-// Choose a thumbnail for a model from its files (embedded 3MF preview, if any).
+// Choose a thumbnail for a model from its files: an embedded 3MF preview, else
+// a picture that came with the model.
 function pickThumbnail(files) {
   const threeMf = files.find((f) => f.format === '3mf');
-  if (!threeMf) return null;
-  return fileProcessor.extract3mfThumbnail(threeMf.filePath, path.parse(threeMf.fileName).name);
+  const embedded = threeMf && fileProcessor.extract3mfThumbnail(threeMf.filePath, path.parse(threeMf.fileName).name);
+  if (embedded) return embedded;
+  const image = files.find((f) => ['png', 'jpg', 'jpeg', 'gif', 'webp'].includes(f.format));
+  return image ? fileProcessor.copyAsThumbnail(image.filePath, path.parse(image.fileName).name) : null;
 }
 
 // Transform a stored model into the public shape (thumbnail path -> URL).
@@ -82,7 +89,7 @@ const upload = multer({
   storage,
   fileFilter: (req, file, cb) => {
     if (fileProcessor.isAllowed(file.originalname)) cb(null, true);
-    else cb(new Error(`Unsupported file type. Allowed: ${fileProcessor.MODEL_FORMATS.join(', ')}`));
+    else cb(new Error(`Unsupported file type. Allowed: ${fileProcessor.ALLOWED_FORMATS.join(', ')}`));
   },
 });
 
@@ -474,6 +481,7 @@ app.delete('/api/trash', async (req, res, next) => {
 async function purgeModel(id) {
   const removed = await store.deleteModel(id);
   if (!removed) return;
+  removed.fileIds.forEach(archives.removeExtracted);
   for (const p of [...removed.filePaths, ...removed.glbPaths, removed.thumbnailPath]) {
     if (!p) continue;
     try { fs.unlinkSync(p); } catch (err) {
@@ -534,46 +542,95 @@ app.get('/api/models/:id/download', async (req, res, next) => {
   } catch (e) { next(e); }
 });
 
-// Serve a raw model file (used by the in-browser 3D viewer).
+// Send a stored file as a download, or with ?inline=1 for display in the page
+// (images, PDFs, text). SVGs are sandboxed so scripts inside them can't run.
+function sendStored(req, res, absPath, name) {
+  res.set('X-Content-Type-Options', 'nosniff');
+  const ext = path.extname(name).toLowerCase();
+  if (ext === '.svg') res.set('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+  if (req.query.inline !== '1') return res.download(absPath, name);
+  if (['.md', '.mtl', '.txt'].includes(ext)) res.type('text/plain');
+  res.sendFile(absPath);
+}
+
+// Serve a stored file (downloads, and the in-browser viewers).
 app.get('/api/files/:id/raw', async (req, res, next) => {
   try {
-    const { rows } = await db.query('SELECT file_path, original_name FROM files WHERE id = $1', [req.params.id]);
-    if (rows.length === 0) return res.status(404).json({ error: 'File not found' });
-    const abs = path.resolve(rows[0].file_path);
+    const file = await store.getFile(req.params.id);
+    if (!file) return res.status(404).json({ error: 'File not found' });
+    const abs = path.resolve(file.file_path);
     if (!fs.existsSync(abs)) return res.status(404).json({ error: 'File missing on disk' });
-    res.download(abs, rows[0].original_name);
+    sendStored(req, res, abs, file.original_name);
+  } catch (e) { next(e); }
+});
+
+// What's inside an archive file (indexed in the background).
+app.get('/api/files/:id/entries', async (req, res, next) => {
+  try {
+    const file = await store.getFile(req.params.id);
+    if (!file) return res.status(404).json({ error: 'File not found' });
+    if (!fileProcessor.ARCHIVE_FORMATS.includes(file.format)) return res.status(400).json({ error: 'Not an archive' });
+    res.json({
+      status: file.archive_status || 'pending',
+      error: file.archive_error,
+      entries: await store.getArchiveEntries(file.id),
+    });
+  } catch (e) { next(e); }
+});
+
+// Serve a file from inside an archive (extracted on first use, then cached).
+app.get('/api/entries/:id/raw', async (req, res, next) => {
+  try {
+    const entry = await store.getArchiveEntry(req.params.id);
+    if (!entry) return res.status(404).json({ error: 'Entry not found' });
+    const abs = await archives.extractEntry(entry.archive, entry);
+    sendStored(req, res, abs, path.posix.basename(entry.path));
   } catch (e) { next(e); }
 });
 
 // Serve a 3MF as GLB, converting on first request (cached thereafter). This lets
 // the browser render Bambu/MakerWorld 3MFs and backfills volume/bbox.
-const glbConversions = new Map(); // fileId -> in-flight Promise
+const glbConversions = new Map(); // output path -> in-flight Promise
+
+// Converts into a temporary file and renames it into place, so a half-written
+// GLB is never served.
+function convertOnce(inputPath, outPath) {
+  if (!glbConversions.has(outPath)) {
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    const tmp = `${outPath}.part`;
+    glbConversions.set(outPath, converter.convert3mfToGlb(inputPath, tmp)
+      .then((result) => { fs.renameSync(tmp, outPath); return result; })
+      .finally(() => { fs.rmSync(tmp, { force: true }); glbConversions.delete(outPath); }));
+  }
+  return glbConversions.get(outPath);
+}
 
 app.get('/api/files/:id/glb', async (req, res, next) => {
   try {
-    const { rows } = await db.query('SELECT id, file_path, format, glb_path FROM files WHERE id = $1', [req.params.id]);
-    if (rows.length === 0) return res.status(404).json({ error: 'File not found' });
-    const file = rows[0];
+    const file = await store.getFile(req.params.id);
+    if (!file) return res.status(404).json({ error: 'File not found' });
     if (file.format !== '3mf') return res.status(415).json({ error: 'GLB conversion is only for 3MF files' });
 
     let glbPath = file.glb_path;
     if (!glbPath || !fs.existsSync(glbPath)) {
-      if (!glbConversions.has(file.id)) {
-        glbConversions.set(file.id, convertFileToGlb(file).finally(() => glbConversions.delete(file.id)));
-      }
-      glbPath = await glbConversions.get(file.id);
+      glbPath = path.join('./glb', `${file.id}.glb`);
+      const result = await convertOnce(path.resolve(file.file_path), path.resolve(glbPath));
+      await store.updateFileConversion(file.id, { glb_path: glbPath, volume: result.volume_cm3, bbox: result.bbox });
     }
     res.sendFile(path.resolve(glbPath));
   } catch (e) { next(e); }
 });
 
-async function convertFileToGlb(file) {
-  if (!fs.existsSync('./glb')) fs.mkdirSync('./glb', { recursive: true });
-  const out = path.join('./glb', `${file.id}.glb`);
-  const result = await converter.convert3mfToGlb(path.resolve(file.file_path), path.resolve(out));
-  await store.updateFileConversion(file.id, { glb_path: out, volume: result.volume_cm3, bbox: result.bbox });
-  return out;
-}
+app.get('/api/entries/:id/glb', async (req, res, next) => {
+  try {
+    const entry = await store.getArchiveEntry(req.params.id);
+    if (!entry) return res.status(404).json({ error: 'Entry not found' });
+    if (entry.format !== '3mf') return res.status(415).json({ error: 'GLB conversion is only for 3MF files' });
+    const glbPath = path.resolve('./glb', `entry-${entry.id}.glb`);
+    if (!fs.existsSync(glbPath)) await convertOnce(await archives.extractEntry(entry.archive, entry), glbPath);
+    res.sendFile(glbPath);
+  } catch (e) { next(e); }
+});
 
 // ----------------------------------------------------------------- import
 // Unified import. Thingiverse downloads files automatically (needs a token);
@@ -874,7 +931,8 @@ app.get('/api/library/stats', async (req, res, next) => {
 app.get('/api/duplicates', async (req, res, next) => {
   try {
     const [groups, pending] = await Promise.all([findDuplicateGroups(), fingerprint.pendingCount()]);
-    const found = await store.getModelsByIds(groups.flatMap((g) => g.modelIds));
+    const ids = groups.flatMap((g) => g.modelIds);
+    const [found, counts] = await Promise.all([store.getModelsByIds(ids), store.matchableCounts(ids)]);
     const byId = new Map(found.map((m) => [m.id, m]));
     const result = groups
       .map((g) => ({ ...g, models: g.modelIds.map((id) => byId.get(id)).filter(Boolean) }))
@@ -883,7 +941,11 @@ app.get('/api/duplicates', async (req, res, next) => {
         signature: duplicates.signature(g.modelIds),
         exact: g.exact,
         recommendedId: duplicates.recommendKeep(g.models),
-        models: g.models.map((m) => ({ ...publicModel(m), matchedFiles: g.matchedFiles[m.id] })),
+        models: g.models.map((m) => ({
+          ...publicModel(m),
+          matchedFiles: g.matchedFiles[m.id],
+          matchableFiles: counts[m.id] ?? m.files.length,
+        })),
       }));
     res.json({ pending, groups: result });
   } catch (e) { next(e); }
diff --git a/test/archives.test.js b/test/archives.test.js
new file mode 100644
index 0000000..a9093df
--- /dev/null
+++ b/test/archives.test.js
@@ -0,0 +1,47 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+process.env.EXTRACT_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'printhive-extract-'));
+const archives = require('../lib/archives');
+
+const fixture = (name) => path.join(__dirname, 'fixtures', name);
+const sha = (p) => crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex');
+const clean = (p) => p.replace(/^\.\//, '');
+
+// Each pack holds models/cube.stl, models/inner.3mf and readme.txt, plus macOS
+// junk (._ files, __MACOSX, .DS_Store); the zip also has a ../ path.
+const EXPECTED = ['models/cube.stl', 'models/inner.3mf', 'readme.txt'];
+
+test.after(() => fs.rmSync(process.env.EXTRACT_DIR, { recursive: true, force: true }));
+
+for (const [name, format] of [['pack.zip', 'zip'], ['pack.7z', '7z'], ['pack.tar.gz', 'tgz']]) {
+  const file = { id: `test-${format}`, file_path: fixture(name), format };
+
+  test(`${name}: lists real files, skipping folders, junk and unsafe paths`, async () => {
+    const entries = await archives.listEntries(file);
+    assert.deepEqual(entries.map((e) => clean(e.path)).sort(), EXPECTED);
+    const cube = entries.find((e) => clean(e.path) === 'models/cube.stl');
+    assert.equal(cube.size, fs.statSync(fixture('cube.stl')).size);
+  });
+
+  test(`${name}: extracts one entry byte-for-byte, and caches it`, async () => {
+    const entries = await archives.listEntries(file);
+    const cube = { ...entries.find((e) => clean(e.path) === 'models/cube.stl'), id: 1 };
+    const abs = await archives.extractEntry(file, cube);
+    assert.equal(sha(abs), sha(fixture('cube.stl')));
+    assert.equal(await archives.extractEntry(file, cube), abs);
+  });
+}
+
+test('a missing entry fails clearly instead of returning a path', async () => {
+  const file = { id: 'test-missing', file_path: fixture('pack.zip'), format: 'zip' };
+  await assert.rejects(archives.extractEntry(file, { id: 2, path: 'models/nope.stl' }), /Could not extract/);
+});
+
+test('an unreadable archive rejects', async () => {
+  await assert.rejects(archives.listEntries({ file_path: fixture('cube.stl'), format: 'zip' }));
+});
diff --git a/test/fixtures/pack.7z b/test/fixtures/pack.7z
new file mode 100644
index 0000000000000000000000000000000000000000..97218262651ba4d35506557d1886d2bac0b4e8fb
GIT binary patch
literal 1608
zcmV-O2DkY)dc3bE8~_6%YQD<_1^@s60000Z000000002!@!SglH62O-L~$}DVjZ~Y
ztejg^TreRd1}cHIWhZ(6ZkDX8O}xKQD)T~BPO9pa$#Vq1=3;SEtL`-gQG8#M9;Vv$
z3O4<c(p9zxj~nWgOBrv;dqCsR*W5UwFp`m!Jc2rxselHY<bg;zJd#O}^Emm2l1DY9
z{l!XP|2);f(?NM^8|wQ;g0}}G%Y~Ddw)5xmO<NabADYkJQL4XW$Ectt&f=0@1*Yi_
z!0XJ1L@NDPlruKLzSCUY6walM8ycujR1z~*nu#K;E@ZMMH)fW-o#!R7cOlnTIPb3j
zd;jnas6WKah+CynchscclJXXdoz&e3`F13k&bn=_zH{7?KnyrJh-$zO_`e!BpIagt
z{u!Ei-J^cY*YR-@<q7Me-*8LrbZLbUz%b1u`HztD@%hC^6e<sSgaExBZ<~%zkEFxJ
zBQD<Yx_?%1yWSD6-DgwUk{^V9yQafhL@>^Qch1d13bEf611=mHKql*Re!CSLQ(8Xz
zjBpSHC0VWnJ*1;8m~JD2v7P0@Thz6ZL;~kYi@Im63@=p7t^cP5#k2gKSaz#k{vrCN
zf1x=V(t|e;ZasxvLB})-1)|K-g(P6Q0PI-xU>HnROKQwYD)bB+%AqxdrZobeCSMr?
zsBN9o`RW){Uv)ya6;?Lh_cz{lt=Jo|7xM$3lP8O!Mv1DlGH<R57N4U<i1?HrA}t_V
z`Brb&BM%9JmQNFLH;Ee>)2c^edeS3LTJNuDAv$hG;&<xAHZaiwu;;1a;5V5tLO9=H
zB3rvyL^endFWo0XbBxIEA@)h2rf`97@qV%9nVOf6v+POrwCwWci577nU8a|>{(W-g
z-ztUN;1dmgMTR^<KKKcy(&G8qNAF(DE7it*&n~KW%4nnhK~yMwQOh9m*ZHDphBJ*o
z(g~NG1a#erRg$!o4P@8xw2-x)8q<TzIUG!iG`#`&LHD04azYh{QNQ;8yp@~~J}6YY
zAA4)$XSnPD6$*`b{E519xbNF$EoDeoRVX8l;{BiSPpy+!fMi*;Psg%q+yj0_X0&RN
zvG9GtB%VfaSc0^JwbG&6wx4I!MQhBzT}ah<C@m1t){i^ci>Emv?QfHuX{;!RqMn3t
z=h^<y4*vfbK0ai3iFDW;ZMAQbaUv8U7N14wq){yfcgt=~n(3P`_d|NQEMsla4c_=b
zTLt0^i8mtD*GsppO)+jqZMI;DpGFB!bc1mV#;eKq1CHXYCJ}h3GShd83KRZ)!f{YX
z*#-$BrCEYNn1OyUx=3&v6`FJ4x0NnQnF%8?@7NgV0c-!pE^IH#xZ}Zapq4cIU_-3Q
z%{4v{1p)|K3l6~kWyc<L#~&9rK_JE~CenB{8iu38oT%A}!*!I={69kg&fn<R0GW&~
zL@$U$Uh*@+t%)_<5uCmpz7zuB5T#W2xG>rfqGn}AAUs~cd9a9R#i0l+=05U2lvbWc
z@V&DA+Q1CJ^y8{sa~kBrPKYVAIjHA`6HqMDJinVCpgyJ8_!-A~>v267<tGvhaFXT!
zBJ*prI(D4lKJ$0@*mmI=)VmcS!a{AX6Hdhr-{hPqQ=uqws-(<X95nf+j%5)H^c^k=
zZ-W6bsUCZd8ija91~tb2PGDml^fGCxaIUUkbEQCIaB*zg(E)Mok2<TN-j8R;#s9um
z0BisNfinlL57k~DA;%?0R|VlS>B8if1s}5!Jyj8_vM&p!7_*U7<QClpSp8_%cM=_A
z*PWpcaNL(Mrncbw2p9BGe^L4PCJIgNB5gdf8N3p%@L8&zq<uN|7yy?ka7lE1Vvw~(
z@298Va;?81%|j?P)%P6-M45Z6ctc`iAbJjq@XiMmnAbagcZP)-TjKYc9!9TWtMm_?
zWm8qzA5i*!h8-*UdYIzhir5ZXYj~Q`HLJo!z?N|R0wK)+N&~PC2tF5Nc3F5&S-G=3
zO|KY(|35l`9W=clnBgKBDZ~C}Pl_A+Br&BPgMh_|Z(*j_5<HU0Lr`cSIjbKjZ|~nY
z90T-bPM_t*NGqUPTHg!*@`%2`7Y2my0SSQ?00#>J00AQd0RaVF004jh41!|{0jN}l
G?EnCBH2Kf~

literal 0
HcmV?d00001

diff --git a/test/fixtures/pack.tar.gz b/test/fixtures/pack.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..59869e8a6ccfe6304c326a7e7bf34e10a25e66d9
GIT binary patch
literal 1779
zcmV<P1`PQhiwFqqWvFTb|8QYrYc6zQasboQ*VA_hNUZQkO-xBGVxS2yfB;;yfq}6J
zf(;TkG%zwWVo<1HpaUo^E=eo`TF)>tfsutmZb@cts;!~9g{6s+p@Ffvo~en2g^{@#
z7sDtR_CQZRH$Npcr&vF^G$~cDxFm;0`QOY0lE=->%piH)2%hH+jZ94#3{8zpjSS3;
z%uRvvhQ`Jw#taGu^vwS$iDj87czh33mX<b}UI+mmFxjvlA);`Qfnfm%J3!fvNNf;3
z08<ImrQnE=!O#uYfz^%!SnO~_wgaXUSq7_ps5<P?T;hnu4hNk6aKNG)yB&^r>^O*G
zhdq+d9r3sd)8~$Oe2$_6!;S-Jb~qyIfT@Q29Ni8KpJUbGfFl$RjOH!cl>ejcztQ#|
zTKmrwNE?`sw*N*_`!6#uFSSU|I5&+p`5#aF&&b5Y0KNSOOo^lIKYD-wZ)O$|Ak6{9
ziVR-HUFVIM7#Ko;Tmhhnv5UTO3OIr2fyuK|Pxsw25NZ2f+jT-ZtS^73fXfVD^V){U
z@NJJBR^4#xYhK_V?>s{?XjY=qS&!ZpgNOF>`_G?!y?k-r;^v~*WZ#_%hH);ZJfcn0
zqV=lc4?lgB`8juO?$TQt8NT67bHD!<b((ue^X%>j^Gi3+U9+1OrW}@;_iL8-{oM?X
zm#kVf)HDx?@U%>waZ;e`^|b2yC%CotJHDK$advMJZ~p(XO#8{3%eTE+${)CU(kAgs
zcNj|FevM$9wBPATOxL8n!Iz}g_t;<NY7rLry6mIs1>f6dQLU4k&)!;j?wjALyv^Gl
zO`l|!wMs}pKyqCu=eAR9ORfJNQTVjHwxal?ZO6CO&!5ZR_jb74RWvba1&6A^!xGNQ
zV;X0S^*kISCN0&;Ssc3k_8RBZxtp)?YM1u(sh+rOvB6)pp|Z!_|HQHPAAWtZpOsvc
ze=tsW(+&yS(<^=DX6|_`wov}=lZhv-^8~+LEU-1I+~|=1^5a6yGu!sYy0I6n>}KXY
z^5LkL!Hiy(lL`uxnQW9UR5Qx5oK$)E%Gr+N#$E;4pA&qz*0B`nCnz7ZpL52|&u{)C
zuM=vVFPBXI>0uyn!8h*0g`kWVw>Io}nR3xQ_v@`ilLYlNMJJqQI@}_}$og0$%~R|3
ztY<THQ!_3e)Bc-j{P(}~k@*#;&+uNDe(sCn|LY6i%9_XK#&Xo}*rQzYx$?vB+(q1T
zR9gbrW~zv&MNT}F6sZ}(*|WLpS<nfq6+1sKyY95}qH3YuCGW3uxxdr|=lnxUUqTiQ
z4>tl?%!~{S+(0_M2vqdwfymVUvs{M^1X|wPxt>_6zI!FBVCJQ6@%5L)IZkflHM3V)
z`Qo;;qvOXN#=GyIDf@d@?@61X<ok-NSJo)Km~#D?@1Cg7J8VPt-Y5}|Nzv2JG*g^d
z^jK(l@wtZ_6Rz}xExW~Da#XT*i_vsLKY=B?PH`q4zajU?ytzwWO;V2Wf5){IFDA<u
zuieuc7X9*C;Ho{xg4R3C7K`|NY45StNsh-jjhA1TXP5MM+qqenC!N>m;H#S_=#T2N
zG#A$R=RlS%F!u-p>1gNtypq(slK7Cyg4E(zy^7qNr9s|)M+|uG7I$gP)(e=;B;>T>
ztxnnwM)8iI@64UTs_$0Zky~D)a)F0q<Ced5+wQyxOFt@@G|P6|(a=zFrVBsnj&0Nx
zlRC9K>3Xb5zdqxn1f6AJel8E=R;H*GScTd#d`kInG4qj8pH{}_HSPh|OKVs6xHB!8
zw5jdQEM}gnjVf|sdHMT3X&%rx`j2<U-YCo6IvaSeNS>RodG33{{)r_VWoEM^7WCZ+
z*PHtO<?7k@GGo|sGdgSfC%x7wIC*-WAxDK(@VohGE*oA>cZq-hduHEEX*J(s5Bn6Q
z2uu4v)o=M_%K~p(m#h!)W@Hj!#$Besdl!rhSV|al-RLO>p*w*ICH<glM2`@JMk{8l
z(G%d!$_7%v41_y?bP&sE`+v0kKSJC8rWQt~qwW6@k^hT;IX^d5ucV@cR(23*{~H(>
znxnP<jZ6#;M%({%Y5x~x=9MTUmM9qL8Rh1VX8F<azk#U#jWFwfgVFk*F7>||*81OU
zboO_IjsNMz(`*KqVEu1kia!2lYC1apM;DM)nwLGA)ko|9(f<Ev{~xLTH#asM?f;LA
z{2w3h>*(ws9D!&EP<twn^!ne_aCH7}wEiCjqxJu2{XZb}zs2bKpAnP)U4r9-OY)0S
zX=VrM^}msUxzT9-KU)8ff>AIEM!_f;1*2dTjDk@x3P!;w7zLwX6pVsVFbYP&C>RB!
VU=)mkQ7{Tf0RSs_9FPD|003xFr*!}T

literal 0
HcmV?d00001

diff --git a/test/fixtures/pack.zip b/test/fixtures/pack.zip
new file mode 100644
index 0000000000000000000000000000000000000000..f69c910ffe7896a13d4c4c09057aee164ce3255c
GIT binary patch
literal 2211
zcmai$2UL?+8^=Q;0wN+-K`UigMiB@qBLM`Yf`n0~fK?z8k{}~c2vd;JT3S9t{h$mZ
z2_Rt9vNs__3ep6U0F9NU5QYIohR762=o^nnoAcH0Ip^MYJ->UNd;jPBpV!$QvSU98
z1d;@8nCN)}Hz2TZ0zv{9xKK1E7_SEbIsYTguCjoM2R@eqxw6}7evv2)6dw^>cJmLJ
zRuxI{Lj|WBQ>kndJJ|h@zM-G*6d(=%*gF<(o+|LBN0Xu-O5J*K^mdSpdkzupdM|0@
zc*K`pHsOlBdsHLo%js5mK4AK9OvRaA8sxBzlA?<`ebU{?*r-#Y4bFL<q=BZW=YOHm
zWdC|x!Dn3TpY>IjSSS#7fIuqZAkg0J`T{~iFyT;r99H@@7Axm_@!}{5WxZ2xqI~g;
z!|vUxr^-Rjj|Qx{aCMl4x}lA%1BrN<GM}A{c)B`N{u#&j%3D)$FYFqj-^eN@G;XGH
zI^_a#5xf~QbtuEKW?xqK<)!+ACu{S$iGrC|ytGAmm_mofyScN+uHlV&ayWu~ndgDT
zwU<S#o~9st&IpI`S|*h6j^A+a@iS9`f3!_5k`g;d7_L3Wt7K7;HPrce>~~c3lLv)&
zV-Z)$nCWYoVDAdDJJ;g3vO4Yp&mp}gE-hwpGY2!|G~z{@ec~!;9nLgLMN-<G*H?me
zOce7Solq2wSs9vI9gQwH;h9$1+K*9o*IOGgN(&@Di(l#M!gDt~c({?3OY3UQrS4yY
z!5Oc<Hf|uIE(G#de{Li5>JD^h;!J5}2?8$xt)ZP)ekavd8-7+sDf>GQrN?l;(y6h7
z#{=#=c8~YYHuS^E-NW(ep3Svnr{zbOG#SAInJlw8f#&s=&DXCo`K8bAZ2S;LxgCWV
zAo;x1hT(hss(ySEo$qimfT+1Pi%KqY;hp(uBS%>wkTh5i>q~FBgn{YL|5w(gWjA)I
zI`6D=E(={0QAlvf<`s9fdv-@D!d8wl1bL(Fb=OM}7M5=d_<8yv2?>kJu|(&I_$Krl
zCs|0cG%ZX4x&uRPtn;Nae@UBcLWb%R)b5eBOvVfzkIAc^>7ySBAf2!9H@jVUn-I2;
zyTWytc(_?|gH-{)lCs*igh%e*L?YKb`c4|bvWpVvN<2bOmU6-rbevQ)w6E33&Du&g
ze7vw2!ItbMvAuh~cRW`%@HTcZl1x-^mtKa(CK8$a5)Js2@@bIW`o8K*F^zHz6c&AP
zbSG!Q`o3|;`el_9b(=c<s*vRD)u?jK><9Bcokw$H?_Y@LtA}0Bd>X@^ardA#>dwAc
z3;Std?wx;^VB|?02m94q+W2&qp`G4cFN?`$&FRHGPj9xs>>l~KF4gL@_iM_V$)ER$
zpHrn@)i(2GhE(M!W|a=342FB1E_Rl?<)zX?8D=L!=Q2DqfAQPkhT%HWI^T2zt=6Vk
zKcvbx2KH1HEbpo5IAV?*iYtxGm^kh@!BdzVROb&zh4k@krwmQjrYEJ=i`I46KN<>*
zZ(^ibW^JcThKwyL)C?=s%!{j4>fjy~M_~Q|HygNe5K?o8_vbasV648Baaqi-ne{)o
zP``X(iYHf2Hy?<8p51@XYjkX&krz5#ZyMUhxv@)wT|FFSU~o3?W!nvk-{HuPV#irW
zic%1#q6e;J>HlqRKC`_sODj;^qcCcBzN@(xD<1tPIcp&{J+5_`GxWr4&cR*-7Z|6X
zc8eTX^dGNtJ_4E(LBim=V1if$>k4n^-Z`S3F*O-PdPk~EL`m7)8q`S@zXEGpzDrAN
zy1dfDI#~bgS~o#pTM@a-kwo%mxcDB}2uUC?Q*s`Ak8?LkgD|)A?1q7Mb8D?Oj=*X8
zLc(Bm>(f5<R}ku<TUNPYIa<ehTNz0uS1tR~NvOS)&vKnPvXnDRl9rchQNMp~CN@$U
ztRl`j)d)dIR3*iT_$*>3dP)xPFQLco0!BE-7mdR}BVr<?zv^OXyC8I2j`iwyv3Xz-
zP$KeAoY21k{{smZ_~7GE<d#J<kFuGQpP~)}6cYK3<!L9kb9x`~j}H2Oc`1O0TDc+J
zB0|G4|1+D4JDqb7$dU(!v@jd0hlvUZ7Vb{Fo1w?Hbz#`++UvR^?A#fhI#Anh#DGnT
zf%ilHy<GvT0I?Uuw-jDKR4odLHZNhSFp85kf%yZpbxxwNXlHp(zK7}C@W)dUrA77J
zrf&dBZL2HFiORXnF#ztPI{#Mm-*KU?TTz@W0Ps(!{HZ#G0&hieviZ)x$t{YBD!qjz
bi3JO>ZQY&i#eo;XpAkvWs2B)T_WtQFe@=TD

literal 0
HcmV?d00001